Re: object class discovery userland

[Eamon Walsh <ewalsh@tycho.nsa.gov>]

Stephen Smalley wrote:
> On Wed, 2007-05-23 at 14:17 +0000, Christopher J. PeBenito wrote:

>> The object manager will also have to be modified to get the new class
>> and perm values on a policy reload.
> 
> Why not just require them to remain stable at runtime, and require a
> restart of the object manager if you are going to change them?  Allowing
> them to change at any time will introduce a fair amount of
> complexity/overhead at runtime.
> 

I'm fine with this, however I think it should be the kernel's job to 
enforce the stability of the values.  The policyload should fail if the 
values are changing.

Perhaps this could be a configurable "experimental" versus "production" 
option, or perhaps userspace object managers could somehow register with 
the kernel which will then refuse to change the values if any are 
currently running.


-- 
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.